Extracted

• • Target

    87da16b9e0f9fc7d74735c59b920dea8460d91f497380aa1a83834b86771b9e2.exe

  • Size

    619KB

  • MD5

    9ca0138738dcc4faa58c59c0898d4834

  • SHA1

    d904efbf202092b4b29862951c2b39d1c298ac1b

  • SHA256

    87da16b9e0f9fc7d74735c59b920dea8460d91f497380aa1a83834b86771b9e2

  • SHA512

    15acd62254345446b20d040924c397989ff7fb3257c01de6f998fd36a4798d696942a9e9a939158133622e4927f1f155fc5db946c5a92c64f73f625d078774d0

  • SSDEEP

    12288:2qkIddrO3HTLOGOlN1ruuG3DeoNjqqtRaG31TAHcF1umM:3vdxOXTL+bi/dXaGDF1umM

  Score

  10^/10

  guloadervipkeyloggerdiscoverydownloaderkeyloggerpersistencestealer

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    cf85183b87314359488b850f9e97a698

  • SHA1

    6b6c790037eec7ebea4d05590359cb4473f19aea

  • SHA256

    3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

  • SHA512

    fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

  • SSDEEP

    96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug

  Score

  3^/10

  discovery
  behavioral3behavioral4